Executive brief
A vulnerability was identified in the Linux kernel's Phonet network protocol implementation. This flaw could allow a local attacker to cause a system crash or unpredictable behavior by triggering a memory error during the removal of network devices. This primarily impacts system stability and availability.
Technical details
A use-after-free vulnerability exists in net/phonet/pn_dev.c within the Linux kernel. The function phonet_device_destroy() removes a phonet_device from the per-network namespace device list using list_del_rcu() but immediately frees the memory using kfree(). This creates a race condition where RCU readers concurrently traversing the list may still hold a reference to the freed object, leading to a slab-use-after-free. The fix replaces kfree() with kfree_rcu() to ensure the memory is only released after the RCU grace period has expired. This issue affects systems using the Phonet stack, typically used for communication with cellular modems.
Affected products
- Linux Linux 2.6.33 to 6.18.36, 7.0.13
Timeline
- 2026-06-03: other: Patch authored
- 2026-06-25: disclosed: CVE published